diff --git a/.env.example b/.env.example
index 85a89a8..5256420 100644
--- a/.env.example
+++ b/.env.example
@@ -28,4 +28,9 @@ RC_DB_PASSWORD=changeme
 RC_DB_ROOT_PASSWORD=changeme
 
 # Roundcube DES key (24 chars, used to encrypt stored IMAP passwords)
+# Generate one with scripts/generate-des-key.ps1
 RC_DES_KEY=changeme_24_char_key!!!
+
+# Custom Roundcube skin, mounted from a sibling checkout of ep-roundcube-skin
+ROUNDCUBE_SKIN_NAME=eternity
+ROUNDCUBE_SKIN_PATH=../ep-roundcube-skin/eternity
diff --git a/docker-compose.yml b/docker-compose.yml
index b5351ef..50e1cdb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -75,6 +75,7 @@ services:
 
     volumes:
       - ${DATA_ROOT:-/opt/eternitymail}/roundcube-config:/var/roundcube/config:ro
+      - ${ROUNDCUBE_SKIN_PATH:-../ep-roundcube-skin/eternity}:/var/www/html/skins/${ROUNDCUBE_SKIN_NAME:-eternity}:ro
 
     environment:
       ROUNDCUBEMAIL_DB_TYPE: mysql
@@ -94,7 +95,7 @@ services:
 
       ROUNDCUBEMAIL_USERNAME_DOMAIN: ${MAIL_DOMAIN}
 
-      ROUNDCUBEMAIL_SKIN: elastic
+      ROUNDCUBEMAIL_SKIN: ${ROUNDCUBE_SKIN_NAME:-eternity}
       ROUNDCUBEMAIL_PLUGINS: archive,zipdownload,newmail_notifier
       ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 50M
 
diff --git a/scripts/generate-des-key.ps1 b/scripts/generate-des-key.ps1
new file mode 100644
index 0000000..994c528
--- /dev/null
+++ b/scripts/generate-des-key.ps1
@@ -0,0 +1,7 @@
+<#
+.SYNOPSIS
+    Generates a random 24-character key suitable for RC_DES_KEY in .env.
+#>
+
+$key = -join ((48..57) + (65..90) + (97..122) | Get-Random -Count 24 | ForEach-Object { [char]$_ })
+Write-Output $key